SnowPro Advanced: Security Engineer Question 254
Select 3Map evidence to security frameworks (such as GDPR, HIPAA, etc.)A healthcare company stores patient analytics data in Snowflake and must support both HIPAA and GDPR evidence requests during an external audit. The security team needs to provide evidence that access to protected health information (PHI) and personal data is restricted, monitored, and traceable. Which TWO pieces of evidence are the most appropriate to map directly to these framework requirements using Snowflake-native capabilities?
- A
Query ACCOUNT_USAGE.ACCESS_HISTORY and GRANTS_TO_USERS/GRANTS_TO_ROLES to show which roles had access to sensitive objects and which users inherited those privileges over time
- B
Provide a list of virtual warehouses and their sizes to demonstrate that compute was isolated for regulated workloads
- C
Export LOGIN_HISTORY and QUERY_HISTORY to show user authentication events and activity against objects containing regulated data
- D
Show the SQL text used to create transient tables so auditors can verify that fail-safe storage costs were minimized for compliance
- E
Provide masking policy and row access policy definitions attached to columns/tables containing PHI or personal data
Show answer and explanation
Correct answers: A, C, E
Explanation
The best evidence is the evidence that maps directly to the control objective being audited. In this scenario, the requested evidence is that access to regulated data is restricted, monitored, and traceable. Snowflake-native evidence that aligns well includes: policy definitions such as masking policies and row access policies for restriction; ACCESS_HISTORY, LOGIN_HISTORY, and QUERY_HISTORY for monitoring and traceability; and grants metadata for demonstrating role-based privilege assignment and inheritance.
For HIPAA, auditors commonly look for evidence supporting access control and audit controls around ePHI. For GDPR, organizations often need to demonstrate accountability, appropriate technical measures, and restricted access to personal data. Snowflake documentation for Account Usage views such as ACCESS_HISTORY, LOGIN_HISTORY, QUERY_HISTORY, and grants-related views provides the metadata needed for these demonstrations. Snowflake documentation on dynamic data masking and row access policies provides the implementation evidence for restricting data exposure. By contrast, warehouse sizing and transient table design are not direct evidence for these specific framework requirements.
- A. Correct.
Correct. ACCESS_HISTORY helps demonstrate traceability of data access at the object and column level, while GRANTS views help show how privileges were assigned through roles and inherited by users. This is strong evidence for auditor requests related to least privilege, access governance, and accountability. For HIPAA, this supports safeguards around controlling and reviewing access to ePHI. For GDPR, it supports demonstrating appropriate technical and organizational measures limiting access to personal data.
- B. Incorrect.
Incorrect. Warehouse size and isolation can be relevant to performance management or cost attribution, but they are not primary evidence for framework controls focused on restricting, monitoring, and tracing access to regulated data. Auditors asking about HIPAA or GDPR access controls typically want evidence tied to identity, privilege assignment, and data access events, not compute sizing.
- C. Correct.
Correct. LOGIN_HISTORY provides authentication-related evidence, and QUERY_HISTORY helps show user activity and queries executed. Combined with other metadata, this supports proving that access was monitored and can be investigated. For HIPAA audit-control expectations and GDPR accountability, authentication and activity records are relevant evidence. However, QUERY_HISTORY alone may not prove object-level access as precisely as ACCESS_HISTORY, which is why both are commonly useful.
- D. Incorrect.
Incorrect. Transient tables relate to data lifecycle and storage behavior, not directly to evidence that access to PHI or personal data is restricted, monitored, and traceable. Also, minimizing fail-safe cost is not a compliance control objective under HIPAA or GDPR. This option reflects a common confusion between storage design choices and security-control evidence.
- E. Correct.
Correct. Masking policies and row access policies are direct Snowflake-native controls for restricting exposure of sensitive data. Showing policy definitions and their attachment to regulated columns or tables is highly relevant evidence for demonstrating access restriction and data minimization in practice. This maps well to GDPR principles around limiting exposure of personal data and to HIPAA expectations for restricting access to ePHI based on role or need to know.